Fine-grained access control via database roles

ABSTRACT

Embodiments of the present disclosure provide techniques for defining database roles to allow sharing of the objects within a database in a more granular fashion. A set of database roles is created within a database container of a provider account, each database role comprising a separate object from any of a plurality of objects within the database container. A set of grants to a particular subset of the plurality of data objects of the database container is assigned to each of the set of database roles. A share object to which each of the set of database roles has been granted is mounted within a consumer account, thereby generating an imported database container having an imported copy of each of the set of database roles within the consumer account. Certain imported copies of the set of database roles are granted to account level roles of the consumer account.

PRIORITY CLAIM

This application is a continuation of application Ser. No. 17/464,538,filed Sep. 1, 2021 and entitled “FINE-GRAINED ACCESS CONTROL VIADATABASE ROLES,” which claims priority to U.S. provisional applicationNo. 63/237,490, filed on Aug. 26, 2021 and entitled “FINE-GRAINED ACCESSCONTROL VIA DATABASE ROLES,” the disclosures of which are herebyincorporated by reference.

TECHNICAL FIELD

The present disclosure relates to data sharing platforms, andparticularly to modularizing the sharing of data.

BACKGROUND

Databases are widely used for data storage and access in computingapplications. Databases may include one or more tables that include orreference data that can be read, modified, or deleted using queries.Databases may be used for storing and/or accessing personal informationor other sensitive information. Secure storage and access of databasedata may be provided by encrypting and/or storing data in an encryptedform to prevent unauthorized access. In some cases, data sharing may bedesirable to let other parties perform queries against a set of data.

BRIEF DESCRIPTION OF THE DRAWINGS

The described embodiments and the advantages thereof may best beunderstood by reference to the following description taken inconjunction with the accompanying drawings. These drawings in no waylimit any changes in form and detail that may be made to the describedembodiments by one skilled in the art without departing from the spiritand scope of the described embodiments.

FIG. 1A is a block diagram depicting an example computing environment inwhich the methods disclosed herein may be implemented, in accordancewith some embodiments of the present invention.

FIG. 1B is a block diagram illustrating an example virtual warehouse, inaccordance with some embodiments of the present invention.

FIG. 2 is a schematic block diagram of data that may be used toimplement a public or private data exchange, in accordance with someembodiments of the present invention.

FIGS. 3A-3C are schematic block diagrams of consumer and providermanaged data access techniques, in accordance with some embodiments ofthe present invention.

FIG. 4 is a block diagram of a cloud deployment of a data exchange, inaccordance with some embodiments of the present invention.

FIGS. 5A-5D are a block diagrams illustrating the lifecycle of a datasharing operation that utilizes database roles, in accordance with someembodiments of the present invention.

FIG. 6 is a diagram illustrating the use of hidden roles to grant adatabase role to a share object, in accordance with some embodiments ofthe present invention.

FIG. 7 is a flow diagram of a method for using database roles to providemodularized data sharing, in accordance with some embodiments of thepresent invention.

FIG. 8 is a block diagram of an example computing device that mayperform one or more of the operations described herein, in accordancewith some embodiments of the present invention.

DETAILED DESCRIPTION

Data providers often have data assets that are cumbersome to share. Adata asset may be data that is of interest to another entity. Forexample, a large online retail company may have a data set that includesthe purchasing habits of millions of consumers over the last ten years.This data set may be large. If the online retailer wishes to share allor a portion of this data with another entity, the online retailer mayneed to use old and slow methods to transfer the data, such as afile-transfer-protocol (FTP), or even copying the data onto physicalmedia and mailing the physical media to the other entity. This hasseveral disadvantages. First, it is slow as copying terabytes orpetabytes of data can take days. Second, once the data is delivered, theprovider cannot control what happens to the data. The recipient canalter the data, make copies, or share it with other parties. Third, theonly entities that would be interested in accessing such a large dataset in such a manner are large corporations that can afford the complexlogistics of transferring and processing the data as well as the highprice of such a cumbersome data transfer. Thus, smaller entities (e.g.,“mom and pop” shops) or even smaller, more nimble cloud-focused startupsare often priced out of accessing this data, even though the data may bevaluable to their businesses. This may be because raw data assets aregenerally too unpolished and full of potentially sensitive data tosimply outright sell/provide to other companies. Data cleaning,de-identification, aggregation, joining, and other forms of dataenrichment need to be performed by the owner of data before it isshareable with another party. This is time-consuming and expensive.Finally, it is difficult to share data assets with many entities becausetraditional data sharing methods do not allow scalable sharing for thereasons mentioned above. Traditional sharing methods also introducelatency and delays in terms of all parties having access to the mostrecently-updated data.

Private and public data exchanges may allow data providers to moreeasily and securely share their data assets with other entities. Apublic data exchange (also referred to herein as a “Snowflake datamarketplace,” or a “data marketplace”) may provide a centralizedrepository with open access where a data provider may publish andcontrol live and read-only data sets to thousands of consumers. Aprivate data exchange (also referred to herein as a “data exchange”) maybe under the data provider's brand, and the data provider may controlwho can gain access to it. The data exchange may be for internal useonly, or may also be opened to consumers, partners, suppliers, orothers. The data provider may control what data assets are listed aswell as control who has access to which sets of data. This allows for aseamless way to discover and share data both within a data provider'sorganization and with its business partners.

The data exchange may be facilitated by a cloud computing service suchas SNOWFLAKE™, and allows data providers to offer data assets directlyfrom their own online domain (e.g., website) in a private onlinemarketplace with their own branding. The data exchange may provide acentralized, managed hub for an entity to list internally orexternally-shared data assets, inspire data collaboration, and also tomaintain data governance and to audit access. With the data exchange,data providers may be able to share data without copying it betweencompanies. Data providers may invite other entities to view their datalistings, control which data listings appear in their private onlinemarketplace, control who can access data listings and how others caninteract with the data assets connected to the listings. This may bethought of as a “walled garden” marketplace, in which visitors to thegarden must be approved and access to certain listings may be limited.

As an example, Company A may be a consumer data company that hascollected and analyzed the consumption habits of millions of individualsin several different categories. Their data sets may include data in thefollowing categories: online shopping, video streaming, electricityconsumption, automobile usage, internet usage, clothing purchases,mobile application purchases, club memberships, and online subscriptionservices. Company A may desire to offer these data sets (or subsets orderived products of these data sets) to other entities. For example, anew clothing brand may wish to access data sets related to consumerclothing purchases and online shopping habits. Company A may support apage on its website that is or functions substantially similar to a dataexchange, where a data consumer (e.g., the new clothing brand) maybrowse, explore, discover, access and potentially purchase data setsdirectly from Company A. Further, Company A may control: who can enterthe data exchange, the entities that may view a particular listing, theactions that an entity may take with respect to a listing (e.g., viewonly), and any other suitable action. In addition, a data provider maycombine its own data with other data sets from, e.g., a public dataexchange (also referred to as a “Snowflake data marketplace,” or a “datamarketplace”), and create new listings using the combined data.

A data exchange may be an appropriate place to discover, assemble,clean, and enrich data to make it more monetizable. A large company on adata exchange may assemble data from across its divisions anddepartments, which could become valuable to another company. Inaddition, participants in a private ecosystem data exchange may worktogether to join their datasets together to jointly create a useful dataproduct that any one of them alone would not be able to produce. Oncethese joined datasets are created, they may be listed on the dataexchange or on the data marketplace.

Sharing data may be performed when a data provider creates a shareobject (hereinafter referred to as a share) of a database in the dataprovider's account and grants the share access to particular objects(e.g., tables, secure views, and secure user-defined functions (UDFs))of the database. Then, a read-only database may be created usinginformation provided in the share. Access to this database may becontrolled by the data provider. A “share” encapsulates all of theinformation required to share data in a database. A share may include atleast three pieces of information: (1) privileges that grant access tothe database(s) and the schema containing the objects to share, (2) theprivileges that grant access to the specific objects (e.g., tables,secure views, and secure UDFs), and (3) the consumer accounts with whichthe database and its objects are shared. The consumer accounts withwhich the database and its objects are shared may be indicated by a listof references to those consumer accounts contained within the shareobject. Only those consumer accounts that are specifically listed in theshare object may be allowed to look up, access, and/or import from thisshare object. By modifying the list of references of other consumeraccounts, the share object can be made accessible to more accounts or berestricted to fewer accounts.

In some embodiments, each share object contains a single role. Grantsbetween this role and objects define what objects are being shared andwith what privileges these objects are shared. The role and grants maybe similar to any other role and grant system in the implementation ofrole-based access control. By modifying the set of grants attached tothe role in a share object, more objects may be shared (by adding grantsto the role), fewer objects may be shared (by revoking grants from therole), or objects may be shared with different privileges (by changingthe type of grant, for example to allow write access to a shared tableobject that was previously read-only). In some embodiments, shareobjects in a provider account may be imported into the target consumeraccount using alias objects and cross-account role grants.

When data is shared, no data is copied or transferred between users.Sharing is accomplished through the cloud computing services of a cloudcomputing service provider such as SNOWFLAKE™. Shared data may then beused to process SQL queries, possibly including joins, aggregations, orother analysis. In some instances, a data provider may define a sharesuch that “secure joins” are permitted to be performed with respect tothe shared data. A secure join may be performed such that analysis maybe performed with respect to shared data but the actual shared data isnot accessible by the data consumer (e.g., recipient of the share).

A data exchange may also implement role-based access control to governaccess to objects within consumer accounts using account level roles andgrants. In one embodiment, account level roles are special objects in aconsumer account that are assigned to users. Grants between theseaccount level roles and database objects define what privileges theaccount level role has on these objects. For example, a role that has ausage grant on a database can “see” this database when executing thecommand “show databases”; a role that has a select grant on a table canread from this table but not write to the table. The role would need tohave a modify grant on the table to be able to write to it.

Today, when a consumer wishes to grant access to a shared database to anaccount level role, all the shared objects granted to the share will bemade available to the local grantee: there is no mechanism for aconsumer to select which particular objects should be made available tolocal roles. To circumvent this, providers may logically separate sourcedata into separate shares to manage access. However, in such scenarios,the provider has to manage a large number of shares and in extremecases, one share per consumer. Any object added by the provider needs tobe added to each eligible share object and unless each consumer has ashare object, consumers have to deal with several imported databases andmight have to drop an imported database and import a newer one. On theconsumer side, consumers may attempt to circumvent the inability toscope the privileges granted to particular users by creating a databaseand generating views that map to each object in the share. However, thisis cumbersome-especially with hundreds and thousands of views. Everyconsumer has to implement this methodology and it only works for viewsand tables, and does not work for shared functions. Any object added toa share needs to result in creation of new objects by the consumer.

Embodiments of the present disclosure address the above noted and otherproblems by defining a database role that is created within a database,and to which privileges are granted by a provider account. The databaserole may be granted to a share object, which would result in the shareobject being indirectly granted all privileges that have been granted tothe database role. Once the share object has been hydrated in theconsumer account, the local administrator can then decide which localroles are granted usage on the shared database role, thus ultimatelyallowing some level of filtering as to which shared objects can beaccessed by which local roles.

FIG. 1A is a block diagram of an example computing environment 100 inwhich the systems and methods disclosed herein may be implemented. Inparticular, a cloud computing platform 110 may be implemented, such asAMAZON WEB SERVICES™ (AWS), MICROSOFT AZURE™, GOOGLE CLOUD™, or thelike. As known in the art, a cloud computing platform 110 providescomputing resources and storage resources that may be acquired(purchased) or leased and configured to execute applications and storedata.

The cloud computing platform 110 may host a cloud computing service 112that facilitates storage of data on the cloud computing platform 110(e.g. data management and access) and analysis functions (e.g. SQLqueries, analysis), as well as other computation capabilities (e.g.,secure data sharing between users of the cloud computing platform 110).The cloud computing platform 110 may include a three-tier architecture:data storage 140, query processing 130, and cloud services 120.

Data storage 140 may facilitate the storing of data on the cloudcomputing platform 110 in one or more cloud databases 141. Data storage140 may use a storage service such as AMAZON S3 to store data and queryresults on the cloud computing platform 110. In particular embodiments,to load data into the cloud computing platform 110, data tables may behorizontally partitioned into large, immutable files which may beanalogous to blocks or pages in a traditional database system. Withineach file, the values of each attribute or column are grouped togetherand compressed using a scheme sometimes referred to as hybrid columnar.Each table has a header which, among other metadata, contains theoffsets of each column within the file.

In addition to storing table data, data storage 140 facilitates thestorage of temp data generated by query operations (e.g., joins), aswell as the data contained in large query results. This may allow thesystem to compute large queries without out-of-memory or out-of-diskerrors. Storing query results this way may simplify query processing asit removes the need for server-side cursors found in traditionaldatabase systems.

Query processing 130 may handle query execution within elastic clustersof virtual machines, referred to herein as virtual warehouses or datawarehouses. Thus, query processing 130 may include one or more virtualwarehouses 131, which may also be referred to herein as data warehouses.The virtual warehouses 131 may be one or more virtual machines operatingon the cloud computing platform 110. The virtual warehouses 131 may becompute resources that may be created, destroyed, or resized at anypoint, on demand. This functionality may create an “elastic” virtualwarehouse that expands, contracts, or shuts down according to the user'sneeds. Expanding a virtual warehouse involves generating one or morecompute nodes 132 to a virtual warehouse 131. Contracting a virtualwarehouse involves removing one or more compute nodes 132 from a virtualwarehouse 131. More compute nodes 132 may lead to faster compute times.For example, a data load which takes fifteen hours on a system with fournodes might take only two hours with thirty-two nodes.

Cloud services 120 may be a collection of services that coordinateactivities across the cloud computing service 112. These services tietogether all of the different components of the cloud computing service112 in order to process user requests, from login to query dispatch.Cloud services 120 may operate on compute instances provisioned by thecloud computing service 112 from the cloud computing platform 110. Cloudservices 120 may include a collection of services that manage virtualwarehouses, queries, transactions, data exchanges, and the metadataassociated with such services, such as database schemas, access controlinformation, encryption keys, and usage statistics. Cloud services 120may include, but not be limited to, authentication engine 121,infrastructure manager 122, optimizer 123, exchange manager 124,security 125 engine, and metadata storage 126.

FIG. 1B is a block diagram illustrating an example virtual warehouse131. The exchange manager 124 may facilitate the sharing of data betweendata providers and data consumers, using, for example, a data exchange.For example, cloud computing service 112 may manage the storage andaccess of a database 108. The database 108 may include various instancesof user data 150 for different users, e.g. different enterprises orindividuals. The user data 150 may include a user database 152 of datastored and accessed by that user. The user database 152 may be subjectto access controls such that only the owner of the data is allowed tochange and access the user database 152 upon authenticating with thecloud computing service 112. For example, data may be encrypted suchthat it can only be decrypted using decryption information possessed bythe owner of the data. Using the exchange manager 124, specific datafrom a user database 152 that is subject to these access controls may beshared with other users in a controlled manner according to the methodsdisclosed herein. In particular, a user may specify shares 154 that maybe shared in a public or data exchange in an uncontrolled manner orshared with specific other users in a controlled manner as describedabove. A “share” encapsulates all of the information required to sharedata in a database. A share may include at least three pieces ofinformation: (1) privileges that grant access to the database(s) and theschema containing the objects to share, (2) the privileges that grantaccess to the specific objects (e.g., tables, secure views, and secureUDFs), and (3) the consumer accounts with which the database and itsobjects are shared. When data is shared, no data is copied ortransferred between users. Sharing is accomplished through the cloudservices 120 of cloud computing service 112.

Sharing data may be performed when a data provider creates a share of adatabase in the data provider's account and grants access to particularobjects (e.g., tables, secure views, and secure user-defined functions(UDFs)). Then a read-only database may be created using informationprovided in the share. Access to this database may be controlled by thedata provider.

Shared data may then be used to process SQL queries, possibly includingjoins, aggregations, or other analysis. In some instances, a dataprovider may define a share such that “secure joins” are permitted to beperformed with respect to the shared data. A secure join may beperformed such that analysis may be performed with respect to shareddata but the actual shared data is not accessible by the data consumer(e.g., recipient of the share). A secure join may be performed asdescribed in U.S. application Ser. No. 16/368,339, filed Mar. 18, 2019.

User devices 101-104, such as laptop computers, desktop computers,mobile phones, tablet computers, cloud-hosted computers, cloud-hostedserverless processes, or other computing processes or devices may beused to access the virtual warehouse 131 or cloud service 120 by way ofa network 105, such as the Internet or a private network.

In the description below, actions are ascribed to users, particularlyconsumers and providers. Such actions shall be understood to beperformed with respect to devices 101-104 operated by such users. Forexample, notification to a user may be understood to be a notificationtransmitted to devices 101-104, an input or instruction from a user maybe understood to be received by way of the user's devices 101-104, andinteraction with an interface by a user shall be understood to beinteraction with the interface on the user's devices 101-104. Inaddition, database operations (joining, aggregating, analysis, etc.)ascribed to a user (consumer or provider) shall be understood to includeperforming of such actions by the cloud computing service 112 inresponse to an instruction from that user.

FIG. 2 is a schematic block diagram of data that may be used toimplement a public or data exchange in accordance with an embodiment ofthe present invention. The exchange manager 124 may operate with respectto some or all of the illustrated exchange data 200, which may be storedon the platform executing the exchange manager 124 (e.g., the cloudcomputing platform 110) or at some other location. The exchange data 200may include a plurality of listings 202 describing data that is sharedby a first user (“the provider”). The listings 202 may be listings in adata exchange or in a data marketplace. The access controls, management,and governance of the listings may be similar for both a datamarketplace and a data exchange.

A listing 202 may include metadata 204 describing the shared data. Themetadata 204 may include some or all of the following information: anidentifier of the provider of the shared data, a URL associated with theprovider, a name of the share, a name of tables, a category to which theshared data belongs, an update frequency of the shared data, a catalogof the tables, a number of columns and a number of rows in each table,as well as name for the columns. The metadata 204 may also includeexamples to aid a user in using the data. Such examples may includesample tables that include a sample of rows and columns of an exampletable, example queries that may be run against the tables, example viewsof an example table, example visualizations (e.g., graphs, dashboards)based on a table's data. Other information included in the metadata 204may be metadata for use by business intelligence tools, text descriptionof data contained in the table, keywords associated with the table tofacilitate searching, a link (e.g., URL) to documentation related to theshared data, and a refresh interval indicating how frequently the shareddata is updated along with the date the data was last updated.

The listing 202 may include access controls 206, which may beconfigurable to any suitable access configuration. For example, accesscontrols 206 may indicate that the shared data is available to anymember of the private exchange without restriction (an “any share” asused elsewhere herein). The access controls 206 may specify a class ofusers (members of a particular group or organization) that are allowedto access the data and/or see the listing. The access controls 206 mayspecify that a “point-to-point” share (see discussion of FIG. 4) inwhich users may request access but are only allowed access upon approvalof the provider. The access controls 206 may specify a set of useridentifiers of users that are excluded from being able to access thedata referenced by the listing 202.

Note that some listings 202 may be discoverable by users without furtherauthentication or access permissions whereas actual accesses are onlypermitted after a subsequent authentication step. The access controls206 may specify that a listing 202 is only discoverable by specificusers or classes of users.

Note also that a default function for listings 202 is that the datareferenced by the share is not exportable by the consumer.Alternatively, the access controls 206 may specify that this is notpermitted. For example, access controls 206 may specify that secureoperations (secure joins and secure functions as discussed below) may beperformed with respect to the shared data such that viewing andexporting of the shared data is not permitted.

In some embodiments, once a user is authenticated with respect to alisting 202, a reference to that user (e.g., user identifier of theuser's account with the virtual warehouse 131) is added to the accesscontrols 206 such that the user will subsequently be able to access thedata referenced by the listing 202 without further authentication.

The listing 202 may define one or more filters 208. For example, thefilters 208 may define specific identity data 214 of users that may viewreferences to the listing 202 when browsing the catalog 220. The filters208 may define a class of users (users of a certain profession, usersassociated with a particular company or organization, users within aparticular geographical area or country) that may view references to thelisting 202 when browsing the catalog 220. In this manner, a privateexchange may be implemented by the exchange manager 124 using the samecomponents. In some embodiments, an excluded user that is excluded fromaccessing a listing 202, i.e. adding the listing 202 to the consumedshares 156 of the excluded user, may still be permitted to view arepresentation of the listing when browsing the catalog 220 and mayfurther be permitted to request access to the listing 202 as discussedbelow. Requests to access a listing by such excluded users and otherusers may be listed in an interface presented to the provider of thelisting 202. The provider of the listing 202 may then view demand foraccess to the listing and choose to expand the filters 208 to permitaccess to excluded users or classes of excluded users (e.g., users inexcluded geographic regions or countries).

Filters 208 may further define what data may be viewed by a user. Inparticular, filters 208 may indicate that a user that selects a listing202 to add to the consumed shares 156 of the user is permitted to accessthe data referenced by the listing but only a filtered version that onlyincludes data associated with the identity data 214 of that user,associated with that user's organization, or specific to some otherclassification of the user. In some embodiments, a private exchange isby invitation: users invited by a provider to view listings 202 of aprivate exchange are enabled to do by the exchange manager 124 uponcommunicating acceptance of an invitation received from the provider.

In some embodiments, a listing 202 may be addressed to a single user.Accordingly, a reference to the listing 202 may be added to a set of“pending shares” that is viewable by the user. The listing 202 may thenbe added to a group of shares of the user upon the user communicatingapproval to the exchange manager 124.

The listing 202 may further include usage data 210. For example, thecloud computing service 112 may implement a credit system in whichcredits are purchased by a user and are consumed each time a user runs aquery, stores data, or uses other services implemented by the cloudcomputing service 112. Accordingly, usage data 210 may record an amountof credits consumed by accessing the shared data. Usage data 210 mayinclude other data such as a number of queries, a number of aggregationsof each type of a plurality of types performed against the shared data,or other usage statistics. In some embodiments, usage data for a listing202 or multiple listings 202 of a user is provided to the user in theform of a shared database, i.e. a reference to a database including theusage data is added by the exchange manager 124 to the consumed sharesof the user.

The listing 202 may also include a heat map 211, which may represent thegeographical locations in which users have clicked on that particularlisting. The cloud computing service 112 may use the heat map to makereplication decisions or other decisions with the listing. For example,a data exchange may display a listing that contains weather data forGeorgia, USA. The heat map 211 may indicate that many users inCalifornia are selecting the listing to learn more about the weather inGeorgia. In view of this information, the cloud computing service 112may replicate the listing and make it available in a database whoseservers are physically located in the western United States, so thatconsumers in California may have access to the data. In someembodiments, an entity may store its data on servers located in thewestern United States. A particular listing may be very popular toconsumers. The cloud computing service 112 may replicate that data andstore it in servers located in the eastern United States, so thatconsumers in the Midwest and on the East Coast may also have access tothat data.

The listing 202 may also include one or more tags 213. The tags 213 mayfacilitate simpler sharing of data contained in one or more listings. Asan example, a large company may have a human resources (HR) listingcontaining HR data for its internal employees on a data exchange. The HRdata may contain ten types of HR data (e.g., employee number, selectedhealth insurance, current retirement plan, job title, etc.). The HRlisting may be accessible to 100 people in the company (e.g., everyonein the HR department). Management of the HR department may wish to addan eleventh type of HR data (e.g., an employee stock option plan).Instead of manually adding this to the HR listing and granting each ofthe 100 people access to this new data, management may simply apply anHR tag to the new data set and that can be used to categorize the dataas HR data, list it along with the HR listing, and grant access to the100 people to view the new data set.

The listing 202 may also include version metadata 215. Version metadata215 may provide a way to track how the datasets are changed. This mayassist in ensuring that the data that is being viewed by one entity isnot changed prematurely. For example, if a company has an original dataset and then releases an updated version of that data set, the updatescould interfere with another user's processing of that data set, becausethe update could have different formatting, new columns, and otherchanges that may be incompatible with the current processing mechanismof the recipient user. To remedy this, the cloud computing service 112may track version updates using version metadata 215. The cloudcomputing service 112 may ensure that each data consumer accesses thesame version of the data until they accept an updated version that willnot interfere with current processing of the data set.

The exchange data 200 may further include user records 212. The userrecord 212 may include data identifying the user associated with theuser record 212, e.g. an identifier (e.g., warehouse identifier) of auser having user data 130 in service database 128 and managed by thevirtual warehouse 131.

The user record 212 may list shares 156 associated with the user, e.g.,reference listings 154 created by the user. The user record 212 may listshares 156 consumed by the user, e.g. reference listings 202 created byanother user and that have been associated to the account of the useraccording to the methods described herein. For example, a listing 202may have an identifier that will be used to reference it in the shares154 or consumed shares 156 of a user record 212.

The exchange data 200 may further include a catalog 220. The catalog 220may include a listing of all available listings 202 and may include anindex of data from the metadata 204 to facilitate browsing and searchingaccording to the methods described herein. In some embodiments, listings202 are stored in the catalog in the form of JavaScript Object Notation(JSON) objects.

Note that where there are multiple instances of the virtual warehouse131 on different cloud computing platforms, the catalog 220 of oneinstance of the virtual warehouse 131 may store listings or referencesto listings from other instances on one or more other cloud computingplatforms 110. Accordingly, each listing 202 may be globally unique(e.g., be assigned a globally unique identifier across all of theinstances of the virtual warehouse 131). For example, the instances ofthe virtual warehouses 131 may synchronize their copies of the catalog220 such that each copy indicates the listings 202 available from allinstances of the virtual warehouse 131. In some instances, a provider ofa listing 202 may specify that it is to be available on only onspecified one or more computing platforms 110.

In some embodiments, the catalog 220 is made available on the Internetsuch that it is searchable by a search engine such as BING or GOOGLE.The catalog may be subject to a search engine optimization (SEO)algorithm to promote its visibility. Potential consumers may thereforebrowse the catalog 220 from any web browser. The exchange manager 124may expose uniform resource locators (URLs) linked to each listing 202.This URL may be searchable and can be shared outside of any interfaceimplemented by the exchange manager 124. For example, the provider of alisting 202 may publish the URLs for its listings 202 in order topromote usage of its listing 202 and its brand.

FIG. 3A illustrates a schematic block diagram illustrating share-basedaccess to objects in provider accounts. A provider account A1 containsshare object SH1, which includes grants to database D2, schema S1, andtable T2. The grants on database D2 and schema S1 may be usage grantsand the grant on table T2 may be a select grant. In this case, table T2in schema S1 in database D2 would be shared read-only. Share object SH1may contain a list of references (not shown) to various consumeraccounts, including account A2.

After the share object SH1 is created, it may be imported or referencedby consumer account A2 (which has been listed in the share object SH1).Consumer account A2 may run a command to list all available shareobjects for importing. Only if a share object was created withreferences that included the consumer account A2, can consumer accountA2 reveal the share object using the command to list all share objectsand subsequently import it. In one embodiment, references to a shareobject in another account are always qualified by account name. Forexample, consumer account A2 would reference share SH1 in provideraccount A1 with the example qualified name “A1.SH1.” Upon the shareobject SH1 being imported to consumer account A2 (the imported shareobject being shown as D3), an account level role R3 of the consumeraccount A2 may be given a usage grant G2 to share object D3. In thisway, a user in account A2 with activated role R3 may access data inaccount A1. For example, a user in account A2 may read data in table T2because role R3 has a usage grant on D3, which in turn has a selectgrant on table T2.

However, as can be seen in FIG. 3A, the privileges provided by the shareobject SH2 cannot be modularized to provide access to only certainobjects (e.g., only T2 and F2) of the database D2 that the share objectD3 has grants to. To circumvent this, providers may logically separatesource data into separate shares to manage access, as shown in FIG. 3B.However, in such scenarios, the provider has to manage a large number ofshares and in extreme cases, one share per consumer. Any object added bythe provider needs to be added to each eligible share and unless eachconsumer has a share, consumers have to deal with several importeddatabases and might have to drop an imported database and import a newerone. On the consumer side, consumers may attempt to circumvent theinability to scope the privileges granted to particular users bycreating database and generating views that map to each object in theshare, as shown in FIG. 3C, However, this is cumbersome-especially withhundreds and thousands of views. Every consumer has to implement thismethodology and it only works for views and tables, and does not workfor shared functions. Any object added to a share needs to result increation of new objects by a consumer. FIG. 4 illustrates a cloudenvironment 400 comprising a cloud deployment 405, which may comprise asimilar architecture to cloud computing service 112 (illustrated in FIG.1A) and may be a deployment of a data exchange or data marketplace.Although illustrated with a single cloud deployment, the cloudenvironment 400 may have multiple cloud deployments which may bephysically located in separate remote geographical regions but may allbe deployments of a single data exchange or data marketplace. Databasesand schemas may be used to organize data stored in the cloud deployment405 and each database may belong to a single account within the clouddeployment 405. Each database may be thought of as a container having aclassic folder hierarchy within it. Each database may be a logicalgrouping of schemas and a schema may be a logical grouping of databaseobjects (tables, views, etc.). Each schema may belong to a singledatabase. Together, a database and a schema may comprise a namespace.When performing any operations on objects within a database, thenamespace is inferred from the current database and the schema that isin use for the session. If a database and schema are not in use for thesession, the namespace must be explicitly specified when performing anyoperations on the objects. As shown in FIG. 4, the cloud deployment 405may include a provider account 410 including database DB1.

FIG. 4 also illustrates a database role 415. A database role mayfunction similarly to an account level role, except for the fact thatthe database role may be defined inside a database (e.g., DB1 in theexample of FIG. 4) or any appropriate database container (e.g., aschema). The database role 415 may be an object that is of a differenttype than an account level role or any other object (e.g., may be a newobject type) and may be referenced using a qualifier based on the nameof the database it is created within (e.g., DB1.ROLE1). Although thedatabase role 415 may be similar to an account level role with respectto grants of privileges that can be assigned, the database role 415 mayexist exclusively within database DB1 (in which it was defined). Thus,privileges granted to the database role 415 must be limited in scope tothe objects contained in the database DB1 where the database role 415 isdefined.

When a database is replicated, a corresponding account level role couldbe replicated, or the database itself could be designated as the unit ofreplication. By defining the database role 415 within database DB1, aclear separation between the database role 415 and the other units ofreplication (e.g., account level roles) may be realized. Becauseprivileges to a subset of the objects within database DB1 (and no otherdatabase) are granted to the database role 415, the database role 415and the subset of the objects to which it has been granted privileges(e.g., modularized privileges) are all maintained in the database DB1.In addition, the provider account 410 must have a usage privilege on thedatabase DB1 where the database role 415 is defined in order to resolveit.

In this way, if the provider account 410 grants to a consumer accountaccess to a share object which has been granted privileges to thedatabase DB1, then the consumer account may see all of the contents ofDB1. However, by utilizing multiple database roles that are each grantedprivileges to particular objects (e.g., subsets of the objects) withinthe database DB1, the consumer account may only see/access objects forwhich privileges have been granted to the database roles the consumeraccount has been granted access to.

Because a new object type is being used, the database role 415 can bereferenced by its fully qualified name or its relative name, using thesession's current database. For example, “DATABASE ROLE DB1.415” mayreference database role 415 in database DB1. In another example,“DATABASE ROLE 415” may reference database role 415 in a currentdatabase. By contrast, “ROLE ROLE1” may reference an account level rolecalled ROLE1. A provider account can use a command such as e.g., “CREATEDATABASE ROLE DB1.415” in order to generate the database role 415 withindatabase DB1. A provider who wishes to create a database role must haveprivileges for creating database roles in the database they wish tocreate it in (e.g., DB1), as well as a usage privilege on that databasein order to do so.

A database role can be granted to account level roles, or other databaseroles that are within the same database. A database role cannot begranted to another database role from a different database. In someembodiments, a command such as e.g., “SHOW ROLES” may be used by aconsumer to reveal all account level roles, while a command such ase.g., “show database roles in database DB1” may to reveal all databaseroles within the database DB1 (assuming a local database named DB1 wascreated from the data application). Further, a command such as e.g.,“show roles in database DB1” may list the database roles within thedatabase DB1. In other words, the “DATABASE” keyword for the “SHOW”command is optional, but only for that query type. It should be notedthat no account level roles or database roles from another database willbe shown when executing such a command.

It should be noted that although the following examples are discussed interms of the database container a database role is defined within beinga database, this is by example only the database container may be anyappropriate container such as e.g., a schema.

FIGS. 5A-5D illustrate the life cycle of database roles (shown asDB1.ROLE1 and DB1.ROLE2) in the context of providing modular access tothe contents of a database DB1. As shown in FIG. 5A, the provideraccount may create database DB1 which includes schema DB1.S1 which inturn includes views DB1.S1.VIEW1 and DB1.S1.VIEW2 as well as tableDB1.S1.TABLE1. The provider account may then create a share object 505and grant a usage privilege on DB1 to the share object 505, grant ausage privilege on DB1.S1 to the share object 505, and grant a selectprivilege on DB1.S1.VIEW1 to the share object 505.

As shown in FIG. 5B, the provider may create a database role called“DB1.ROLE1,” grant a usage privilege on DB1.S1 to DB1.ROLE1 and thengrant a select privilege on DB1.S1.VIEW2 to DB1.ROLE1. The provideraccount may also create a database role called “DB1.ROLE2,” grant ausage privilege on DB1.S1 to DB1.ROLE2 and then grant a select privilegeon DB1.S1.TABLE1 to DB1.ROLE2. The provider may then add DB1.ROLE1 andDB1.ROLE2 to the share object 505 e.g., by granting DB1.ROLE1 andDB1.ROLE2 to the share object 505 so that objects granted to DB1.ROLE1and DB1.ROLE2 are automatically available to the share object 505. Atthis point, the share object 505 has access to both views DB1.S1.VIEW1and DB1.S1.VIEW2 via having a select privilege on DB1.S1.VIEW1 grantedto it and having DB1.ROLE1 granted to it and also has access to thetable DB1.S1.TABLE1 via having DB1.ROLE2 granted to it.

As shown in FIG. 5C, the consumer may mount the share object 505 andcreate a new shared database (referred to as DB2) from the share object505. DB2 may have a copy of the DB1.ROLE1 and DB1.ROLE2 database roles,which may be referred to as DB2.ROLE1 and DB2.ROLE2 because they are inthe DB2 namespace. The consumer account may run a command to generate alist of shared database roles within DB2, which may reveal DB2.ROLE1 andDB2.ROLE2. The consumer may then run a command to list the privilegesthat have been granted to DB2.ROLE1 and DB2.ROLE2, which may reveal theusage privilege on schema DB1.S1 and the select privilege onDB1.S1.VIEW2 that were granted to DB1.ROLE1 and the usage privilege onschema DB1.S1 and the select privilege on DB1.S1.TABLE1 that weregranted to DB1.ROLE2 (all of which are now duplicated in DB2.ROLE1 andDB2.ROLE2 respectively). As shown in FIG. 5D, the consumer account maygrant DB2.ROLE1 to the EMPLOYEES role which is an account level role,and by doing so grant select access to DB1.S1.VIEW2 (but notDB1.S1.VIEW1 or DB1.S1.TABLE1) to the EMPLOYEES role. Stateddifferently, while DB2 has access to both DB1.S1.VIEW1 and DB1.S1.VIEW2as well as DB1.S1.TABLE1, the EMPLOYEES role only has access toDB1.S1.VIEW2. The consumer account may also grant DB2.ROLE2 to theMANAGERS role which is also an account level role, and by doing so granta select privilege on DB1.S1.TABLE1 (but not DB1.S1.VIEW1 orDB1.S1.VIEW2) to the MANAGERS role. Stated differently, while DB2 hasaccess to both DB1.S1.VIEW1 and DB1.S1.VIEW2 as well as DB1.S1.TABLE1,the MANAGERS role only has access to DB1.S1.TABLE1. In this way, modularaccess to the contents of DB1 is achieved.

As can be seen, the use of database roles does not involve the creationof proxy objects in the consumer account that represent shared objectson which the consumer account can grant local privileges. For example,the use of database roles to share a table called table1 does notrequire creation of a table called proxied_table1 in the consumeraccount or the provision of a select grant on proxied_table1 to e.g.,the EMPLOYEES role. This prevents any aspects of the data sharinglifecycle of shared objects from falling under the responsibility ofe.g., the operator of the data exchange. For example, if creation of aproxy object in the consumer account was required for every sharedobject, then there could be two separate copies of metadata associatedwith the shared object, as well as potentially two separate copies ofthe underlying data as well. This in turn would require updating eachlocal proxied object (on the consumer side) when the original object onthe provider side is updated, modified, or deleted. Embodiments of thepresent disclosure circumvent this by dispensing with the need for proxyobjects representing shared objects.

In some scenarios a provider account may grant a database role tomultiple share objects and a consumer account may mount each of themultiple share objects to generate multiple imported databases in theconsumer account. Subsequently, the consumer account may grant theimported database role in each imported database to the same accountlevel role. However, in such situations, a different database objectmust be granted to each share object in a separate grant, otherwise asingle revoke operation for a given share object/imported database willresult in all grants of the database role to be revoked. To preventthis, embodiments of the present disclosure utilize a concept referredto as a hidden role when granting a database role to a share object.FIG. 6 is a block diagram of a deployment 600 in which the use of hiddenroles to grant a database role to one or more share objects isillustrated. As shown in FIG. 6, when a provider account wishes to granta database role (DB1.ROLE1) to a share object 605, it may create a newhidden role 605A. The hidden role 605A may be a database role or anaccount level role and may be anonymous (i.e., without a name).DB1.ROLE1 may be granted to the hidden role 605A and the hidden role605A may be granted to share object 605. DB1.ROLE1 may be granted toeach share object 605, 606, and 607 in this manner in order to establisha one to one relationship between database roles and share objects. Bydoing so, revocation of DB1.ROLE1 from e.g., share object 605 will notaffect the grant of DB1.ROLE1 to share object 606 or 607. Once DB1.ROLE1has been granted to each share object 605-607 in this manner, theconsumer account may mount each share object 605-607 and generate ashared database 610-612 based on each of the share objects 605-607respectively. In addition, when a share object is deleted, or an accountis removed from a share object, the use of hidden objects also ensuresthat only the grants provided through that share object are dropped. Inshort, any time a database role is granted to a share object, a hiddenrole for that granted database role and for the share object (i.e.,share grantee) will be created.

In some embodiments, any objects granted by a provider account to ashare object will not result in objects being automatically created inthe consumer account. In this way, lifecycle problems can be avoided.For example, if a shared database role is renamed, there is no need forall existing automatically created objects to be renamed as well. Inanother example, if a database role is dropped, there is no need for allexisting automatically created objects to be dropped as well. In afurther example, if a new database role is added to the share object inthe provider account, objects to which the new database role has beengranted privileges will not automatically be created in all existingshared databases in consumer accounts.

In some embodiments, database roles may also be used in data replicationscenarios. For example, when a database having one or more databaseroles is replicated (e.g., with the database as the unit of replication)along with the tables and other objects beneath it, the relationshipsbetween the database roles and the objects in the database (e.g., grantsto the database role) can be maintained.

As can be seen, embodiments of the present disclosure may be used togroup data using database roles which may act like mini-share objectswithin a share object and allow more granular access to the contents ofa database. The use of database roles also provides simplifiedentitlements management for consumers and simplified auditing by mappingpermissions to an account level role. More specifically, withentitlement management centralized within a database role, the processof auditing the users (other account level roles) who have the databaserole and the set of permissions they will inherit.

Using database roles as described herein also allows new objects thatare added to a database to be available immediately for consumption byconsumer account users who have been granted database roles. Stateddifferently, once the sharing via a database role is configured andbeing utilized as discussed herein, any newly added object that isgranted to the database role on the provider side will automaticallybecome available/visible to the account level role that has theequivalent database role on the consumer side via the imported share.The use of database roles also helps to keep the number of cross-grantsbetween account level roles to a minimum. Further, because no proxyobjects are created in the consumer account, there are nosynchronization issues.

As discussed herein, one way to materialize a database container in aconsumer account is by creating a proxy object that indicates that it islinked to the shared database that lives in the provider account. Insome embodiments, because consumers may know more about how they wishfor data access privileges to be defined, the cloud deployment 405 ofFIG. 4 may allow a consumer account to materialize and create a localproxy object for every single object that the provider account wishes toshare.

FIG. 7 is a flow diagram of a method 700 for using database roles toallow sharing of a database's data in a more granular fashion, inaccordance with some embodiments. Method 700 may be performed byprocessing logic that may comprise hardware (e.g., circuitry, dedicatedlogic, programmable logic, a processor, a processing device, a centralprocessing unit (CPU), a system-on-chip (SoC), etc.), software (e.g.,instructions running/executing on a processing device), firmware (e.g.,microcode), or a combination thereof. In some embodiments, the method700 may be performed by a processing device of cloud deployment 405(illustrated in FIG. 4).

Referring simultaneously to FIGS. 5A-5D, at block 705, the provider maycreate a database role called “DB1.ROLE1” within DB1 and at block 710may grant a usage privilege on DB1.S1 to DB1.ROLE1 and then grant aselect privilege on DB1.S1.VIEW2 to DB1.ROLE1. The provider account mayalso create a database role called “DB1.ROLE2,” grant a usage privilegeon DB1.S1 to DB1.ROLE2 and then grant a select privilege onDB1.S1.TABLE1 to DB1.ROLE2. The provider account may then create a shareobject 505 and at block 715 may add DB1.ROLE1 and DB1.ROLE2 to the shareobject 505 e.g., by granting DB1.ROLE1 and DB1.ROLE2 to the share object505 so that objects granted to DB1.ROLE1 and DB1.ROLE2 are automaticallyavailable to the share object 505. At block 720 the provider account maygrant a usage privilege on DB1 to the share object 505, grant a usageprivilege on DB1.S1 to the share object 505, and grant a selectprivilege on DB1.S1.VIEW1 to the share object 505. At this point, theshare object 505 has access to both views DB1.S1.VIEW1 and DB1.S1.VIEW2via having a select privilege on DB1.S1.VIEW1 granted to it and havingDB1.ROLE1 granted to it and also has access to the table DB1.S1.TABLE1via having DB1.ROLE2 granted to it.

At block 725, (referring to FIG. 5C) the consumer may mount the shareobject 505 and create a new shared database (referred to as DB2) fromthe share object 505. DB2 may have a copy of the DB1.ROLE1 and DB1.ROLE2database roles, which may be referred to as DB2.ROLE1 and DB2.ROLE2because they are in the DB2 namespace. The consumer account may run acommand to generate a list of shared database roles within DB2, whichmay reveal DB2.ROLE1 and DB2.ROLE2. The consumer may then run a commandto list the privileges that have been granted to DB2.ROLE1 andDB2.ROLE2, which may reveal the usage privilege on schema DB1.S1 and theselect privilege on DB1.S1.VIEW2 that were granted to DB1.ROLE1 and theusage privilege on schema DB1.S1 and the select privilege onDB1.S1.TABLE1 that were granted to DB1.ROLE2 (all of which are nowduplicated in DB2.ROLE1 and DB2.ROLE2 respectively). At block 730, theconsumer account may grant DB2.ROLE1 to the EMPLOYEES role which is anaccount level role, and by doing so grant select access to DB1.S1.VIEW2(but not DB1.S1.VIEW1 or DB1.S1.TABLE1) to the EMPLOYEES role. Stateddifferently, while DB2 has access to both DB1.S1.VIEW1 and DB1.S1.VIEW2as well as DB1.S1.TABLE1, the EMPLOYEES role only has access toDB1.S1.VIEW2. The consumer account may also grant DB2.ROLE2 to theMANAGERS role which is also an account level role, and by doing so granta select privilege on DB1.S1.TABLE1 (but not DB1.S1.VIEW1 orDB1.S1.VIEW2) to the MANAGERS role. Stated differently, while DB2 hasaccess to both DB1.S1.VIEW1 and DB1.S1.VIEW2 as well as DB1.S1.TABLE1,the MANAGERS role only has access to DB1.S1.TABLE1. In this way, modularaccess to the contents of DB1 is achieved.

FIG. 8 illustrates a diagrammatic representation of a machine in theexample form of a computer system 800 within which a set ofinstructions, for causing the machine to perform any one or more of themethodologies discussed herein for replicating a share object to aremote deployment. More specifically, the machine may modify a shareobject of a first account into a global object wherein the share objectincludes grant metadata indicating share grants to a set of objects of adatabase. The machine may create, in a second account located in aremote deployment, a local replica of the share object on the remotedeployment based on the global object and replicate the set of objectsof the database to a local database replica on the remote deployment;and refresh the share grants to the local replica of the share object.

In alternative embodiments, the machine may be connected (e.g.,networked) to other machines in a local area network (LAN), an intranet,an extranet, or the Internet. The machine may operate in the capacity ofa server or a client machine in a client-server network environment, oras a peer machine in a peer-to-peer (or distributed) networkenvironment. The machine may be a personal computer (PC), a tablet PC, aset-top box (STB), a Personal Digital Assistant (PDA), a cellulartelephone, a web appliance, a server, a network router, a switch orbridge, a hub, an access point, a network access control device, or anymachine capable of executing a set of instructions (sequential orotherwise) that specify actions to be taken by that machine. Further,while only a single machine is illustrated, the term “machine” shallalso be taken to include any collection of machines that individually orjointly execute a set (or multiple sets) of instructions to perform anyone or more of the methodologies discussed herein. In one embodiment,computer system 800 may be representative of a server.

The exemplary computer system 800 includes a processing device 802, amain memory 804 (e.g., read-only memory (ROM), flash memory, dynamicrandom access memory (DRAM), a static memory 805 (e.g., flash memory,static random access memory (SRAM), etc.), and a data storage device818, which communicate with each other via a bus 830. Any of the signalsprovided over various buses described herein may be time multiplexedwith other signals and provided over one or more common buses.Additionally, the interconnection between circuit components or blocksmay be shown as buses or as single signal lines. Each of the buses mayalternatively be one or more single signal lines and each of the singlesignal lines may alternatively be buses.

Computing device 800 may further include a network interface device 908which may communicate with a network 820. The computing device 800 alsomay include a video display unit 810 (e.g., a liquid crystal display(LCD) or a cathode ray tube (CRT)), an alphanumeric input device 812(e.g., a keyboard), a cursor control device 814 (e.g., a mouse) and anacoustic signal generation device 816 (e.g., a speaker). In oneembodiment, video display unit 810, alphanumeric input device 812, andcursor control device 814 may be combined into a single component ordevice (e.g., an LCD touch screen).

Processing device 802 represents one or more general-purpose processingdevices such as a microprocessor, central processing unit, or the like.More particularly, the processing device may be complex instruction setcomputing (CISC) microprocessor, reduced instruction set computer (RISC)microprocessor, very long instruction word (VLIW) microprocessor, orprocessor implementing other instruction sets, or processorsimplementing a combination of instruction sets. Processing device 802may also be one or more special-purpose processing devices such as anapplication specific integrated circuit (ASIC), a field programmablegate array (FPGA), a digital signal processor (DSP), network processor,or the like. The processing device 802 is configured to execute databaserole sharing instructions 825, for performing the operations and stepsdiscussed herein.

The data storage device 818 may include a machine-readable storagemedium 828, on which is stored one or more sets of database role sharinginstructions 825 (e.g., software) embodying any one or more of themethodologies of functions described herein. Database role sharinginstructions 825 may also reside, completely or at least partially,within the main memory 804 or within the processing device 802 duringexecution thereof by the computer system 800; the main memory 804 andthe processing device 802 also constituting machine-readable storagemedia. The database role sharing instructions 825 may further betransmitted or received over a network 820 via the network interfacedevice 808.

The machine-readable storage medium 828 may also be used to storeinstructions to perform a method for determining functions to compile,as described herein. While the machine-readable storage medium 828 isshown in an exemplary embodiment to be a single medium, the term“machine-readable storage medium” should be taken to include a singlemedium or multiple media (e.g., a centralized or distributed database,or associated caches and servers) that store the one or more sets ofinstructions. A machine-readable medium includes any mechanism forstoring information in a form (e.g., software, processing application)readable by a machine (e.g., a computer). The machine-readable mediummay include, but is not limited to, magnetic storage medium (e.g.,floppy diskette); optical storage medium (e.g., CD-ROM); magneto-opticalstorage medium; read-only memory (ROM); random-access memory (RAM);erasable programmable memory (e.g., EPROM and EEPROM); flash memory; oranother type of medium suitable for storing electronic instructions.

Unless specifically stated otherwise, terms such as “receiving,”“routing,” “granting,” “determining,” “publishing,” “providing,”“designating,” “encoding,” or the like, refer to actions and processesperformed or implemented by computing devices that manipulates andtransforms data represented as physical (electronic) quantities withinthe computing device's registers and memories into other data similarlyrepresented as physical quantities within the computing device memoriesor registers or other such information storage, transmission or displaydevices. Also, the terms “first,” “second,” “third,” “fourth,” etc., asused herein are meant as labels to distinguish among different elementsand may not necessarily have an ordinal meaning according to theirnumerical designation.

Examples described herein also relate to an apparatus for performing theoperations described herein. This apparatus may be specially constructedfor the required purposes, or it may comprise a general purposecomputing device selectively programmed by a computer program stored inthe computing device. Such a computer program may be stored in acomputer-readable non-transitory storage medium.

The methods and illustrative examples described herein are notinherently related to any particular computer or other apparatus.Various general purpose systems may be used in accordance with theteachings described herein, or it may prove convenient to construct morespecialized apparatus to perform the required method steps. The requiredstructure for a variety of these systems will appear as set forth in thedescription above.

The above description is intended to be illustrative, and notrestrictive. Although the present disclosure has been described withreferences to specific illustrative examples, it will be recognized thatthe present disclosure is not limited to the examples described. Thescope of the disclosure should be determined with reference to thefollowing claims, along with the full scope of equivalents to which theclaims are entitled.

As used herein, the singular forms “a”, “an” and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. It will be further understood that the terms “comprises”,“comprising”, “includes”, and/or “including”, when used herein, specifythe presence of stated features, integers, steps, operations, elements,and/or components, but do not preclude the presence or addition of oneor more other features, integers, steps, operations, elements,components, and/or groups thereof. Therefore, the terminology usedherein is for the purpose of describing particular embodiments only andis not intended to be limiting.

It should also be noted that in some alternative implementations, thefunctions/acts noted may occur out of the order noted in the figures.For example, two figures shown in succession may in fact be executedsubstantially concurrently or may sometimes be executed in the reverseorder, depending upon the functionality/acts involved.

Although the method operations were described in a specific order, itshould be understood that other operations may be performed in betweendescribed operations, described operations may be adjusted so that theyoccur at slightly different times or the described operations may bedistributed in a system which allows the occurrence of the processingoperations at various intervals associated with the processing.

Various units, circuits, or other components may be described or claimedas “configured to” or “configurable to” perform a task or tasks. In suchcontexts, the phrase “configured to” or “configurable to” is used toconnote structure by indicating that the units/circuits/componentsinclude structure (e.g., circuitry) that performs the task or tasksduring operation. As such, the unit/circuit/component can be said to beconfigured to perform the task, or configurable to perform the task,even when the specified unit/circuit/component is not currentlyoperational (e.g., is not on). The units/circuits/components used withthe “configured to” or “configurable to” language include hardware--forexample, circuits, memory storing program instructions executable toimplement the operation, etc. Reciting that a unit/circuit/component is“configured to” perform one or more tasks, or is “configurable to”perform one or more tasks, is expressly intended not to invoke 35 U.S.C.112, sixth paragraph, for that unit/circuit/component. Additionally,“configured to” or “configurable to” can include generic structure(e.g., generic circuitry) that is manipulated by software and/orfirmware (e.g., an FPGA or a general-purpose processor executingsoftware) to operate in manner that is capable of performing the task(s)at issue. “Configured to” may also include adapting a manufacturingprocess (e.g., a semiconductor fabrication facility) to fabricatedevices (e.g., integrated circuits) that are adapted to implement orperform one or more tasks. “Configurable to” is expressly intended notto apply to blank media, an unprogrammed processor or unprogrammedgeneric computer, or an unprogrammed programmable logic device,programmable gate array, or other unprogrammed device, unlessaccompanied by programmed media that confers the ability to theunprogrammed device to be configured to perform the disclosedfunction(s).

Any combination of one or more computer-usable or computer-readablemedia may be utilized. For example, a computer-readable medium mayinclude one or more of a portable computer diskette, a hard disk, arandom access memory (RAM) device, a read-only memory (ROM) device, anerasable programmable read-only memory (EPROM or Flash memory) device, aportable compact disc read-only memory (CDROM), an optical storagedevice, and a magnetic storage device. Computer program code forcarrying out operations of the present disclosure may be written in anycombination of one or more programming languages. Such code may becompiled from source code to computer-readable assembly language ormachine code suitable for the device or computer on which the code willbe executed.

Embodiments may also be implemented in cloud computing environments. Inthis description and the following claims, “cloud computing” may bedefined as a model for enabling ubiquitous, convenient, on-demandnetwork access to a shared pool of configurable computing resources(e.g., networks, servers, storage, applications, and services) that canbe rapidly provisioned (including via virtualization) and released withminimal management effort or service provider interaction and thenscaled accordingly. A cloud model can be composed of variouscharacteristics (e.g., on-demand self-service, broad network access,resource pooling, rapid elasticity, and measured service), servicemodels (e.g., Software as a Service (“SaaS”), Platform as a Service(“PaaS”), and Infrastructure as a Service (“IaaS”)), and deploymentmodels (e.g., private cloud, community cloud, public cloud, and hybridcloud). The flow diagrams and block diagrams in the attached figuresillustrate the architecture, functionality, and operation of possibleimplementations of systems, methods, and computer program productsaccording to various embodiments of the present disclosure. In thisregard, each block in the flow diagrams or block diagrams may representa module, segment, or portion of code, which comprises one or moreexecutable instructions for implementing the specified logicalfunction(s). It will also be noted that each block of the block diagramsor flow diagrams, and combinations of blocks in the block diagrams orflow diagrams, may be implemented by special purpose hardware-basedsystems that perform the specified functions or acts, or combinations ofspecial purpose hardware and computer instructions. These computerprogram instructions may also be stored in a computer-readable mediumthat can direct a computer or other programmable data processingapparatus to function in a particular manner, such that the instructionsstored in the computer-readable medium produce an article of manufactureincluding instruction means which implement the function/act specifiedin the flow diagram and/or block diagram block or blocks.

The foregoing description, for the purpose of explanation, has beendescribed with reference to specific embodiments. However, theillustrative discussions above are not intended to be exhaustive or tolimit the invention to the precise forms disclosed. Many modificationsand variations are possible in view of the above teachings. Theembodiments were chosen and described in order to best explain theprinciples of the embodiments and its practical applications, to therebyenable others skilled in the art to best utilize the embodiments andvarious modifications as may be suited to the particular usecontemplated. Accordingly, the present embodiments are to be consideredas illustrative and not restrictive, and the invention is not to belimited to the details given herein, but may be modified within thescope and equivalents of the appended claims.

What is claimed is:
 1. A method comprising: generating, within adatabase container of a provider account, a set of database roles, eachof the set of database roles comprising an object that is separate fromany of a plurality of objects the database container is comprised of;assigning to each of the set of database roles, a set of grants to aparticular subset of the plurality of data objects of the databasecontainer; mounting within a consumer account, a share object to whicheach of the set of database roles has been granted, to generate animported database container within the consumer account, the importeddatabase container including an imported copy of each of the set ofdatabase roles; and granting, to each of one or more account level rolesof the consumer account, a subset of the imported copies of the set ofdatabase roles.
 2. The method of claim 1, further comprising: updatingthe database container with an additional object; and assigning to afirst database role of the set of database roles, a grant to theadditional object, wherein the additional object is immediatelyavailable to an account level role of the consumer account to which animported copy of the first database role is granted.
 3. The method ofclaim 2, wherein no new objects are created by the consumer account inresponse to the additional object being added to the database container.4. The method of claim 1, wherein the imported database may access theparticular subset of the plurality of data objects assigned to each ofthe set of database roles and each of the one or more account levelroles may access the particular subset of the plurality of data objectsassigned to each of the subset of imported database roles granted tothat account level role.
 5. The method of claim 1, wherein each of theset of database roles does not include grants to objects outside of thedatabase container.
 6. The method of claim 1, further comprising:granting each of the set of database roles to the share object.
 7. Themethod of claim 6, wherein granting a database role to the share objectcomprises: creating a hidden role; granting the database role to thehidden role; and granting the hidden role to the share object.
 8. Themethod of claim 7, wherein the hidden role comprises a database role oran account level role.
 9. A system comprising: a memory; and aprocessing device, operatively coupled to the memory, the processingdevice to: generate, within a database container of a provider account,a set of database roles, each of the set of database roles comprising anobject that is separate from any of a plurality of objects the databasecontainer is comprised of; assign to each of the set of database roles,a set of grants to a particular subset of the plurality of data objectsof the database container; mount within a consumer account, a shareobject to which each of the set of database roles has been granted, togenerate an imported database container within the consumer account, theimported database container including an imported copy of each of theset of database roles; and grant, to each of one or more account levelroles of the consumer account, a subset of the imported copies of theset of database roles.
 10. The system of claim 9, wherein the processingdevice is further to: update the database container with an additionalobject; and assign to a first database role of the set of databaseroles, a grant to the additional object, wherein the additional objectis immediately available to an account level role of the consumeraccount to which an imported copy of the first database role is granted.11. The system of claim 10, wherein no new objects are created by theconsumer account in response to the additional object being added to thedatabase container.
 12. The system of claim 9, wherein the importeddatabase may access the particular subset of the plurality of dataobjects assigned to each of the set of database roles and each of theone or more account level roles may access the particular subset of theplurality of data objects assigned to each of the subset of importeddatabase roles granted to that account level role.
 13. The system ofclaim 9, wherein each of the set of database roles does not includegrants to objects outside of the database container.
 14. The system ofclaim 9, wherein the processing device is further to: grant each of theset of database roles to the share object.
 15. The system of claim 14,wherein to grant a database role to the share object, the processingdevice is to: create a hidden role; grant the database role to thehidden role; and grant the hidden role to the share object.
 16. Thesystem of claim 15, wherein the hidden role comprises a database role oran account level role.
 17. A non-transitory computer-readable mediumhaving instructions stored thereon which, when executed by a processingdevice, cause the processing device to: generate, within a databasecontainer of a provider account, a set of database roles, each of theset of database roles comprising an object that is separate from any ofa plurality of objects the database container is comprised of; assign toeach of the set of database roles, a set of grants to a particularsubset of the plurality of data objects of the database container; mountwithin a consumer account, a share object to which each of the set ofdatabase roles has been granted, to generate an imported databasecontainer within the consumer account, the imported database containerincluding an imported copy of each of the set of database roles; andgrant, to each of one or more account level roles of the consumeraccount, a subset of the imported copies of the set of database roles.18. The non-transitory computer-readable medium of claim 17, wherein theprocessing device is further to: update the database container with anadditional object; and assign to a first database role of the set ofdatabase roles, a grant to the additional object, wherein the additionalobject is immediately available to an account level role of the consumeraccount to which an imported copy of the first database role is granted.19. The non-transitory computer-readable medium of claim 18, wherein nonew objects are created by the consumer account in response to theadditional object being added to the database container.
 20. Thenon-transitory computer-readable medium of claim 17, wherein theimported database may access the particular subset of the plurality ofdata objects assigned to each of the set of database roles and each ofthe one or more account level roles may access the particular subset ofthe plurality of data objects assigned to each of the subset of importeddatabase roles granted to that account level role.
 21. Thenon-transitory computer-readable medium of claim 17, wherein each of theset of database roles does not include grants to objects outside of thedatabase container.
 22. The non-transitory computer-readable medium ofclaim 17, wherein the processing device is further to: grant each of theset of database roles to the share object.
 23. The non-transitorycomputer-readable medium of claim 22, wherein to grant a database roleto the share object, the processing device is to: create a hidden role;grant the database role to the hidden role; and grant the hidden role tothe share object.
 24. The non-transitory computer-readable medium ofclaim 23, wherein the hidden role comprises a database role or anaccount level role.